Your entire life. Every agent. One memory that answers to you.
A source-grounded product, architecture, and roadmap vision for turning Sibyl from the unusually integrated cross-agent memory system into the sovereign context runtime beneath every agent, project, relationship, archive, and chapter of a life. Humans own the evidence. Governed agents help memory become more useful without becoming its sovereign.
Enter the atlasThe core is no longer a memory experiment. It is a credible multi-tenant context runtime with provenance, tasks, synthesis packets, usage feedback, team scopes, Open Knowledge Format export, and unusually honest evaluation machinery. The next leap is not another retrieval trick. It is turning that runtime into a trustworthy home for an entire life.
Build the sovereign context operating system.
A provenance-complete evidence fabric that turns raw experience and agent trajectories into precise, permissioned, replayable context and reusable competence. Not a chatbot. Not a vector database. Not a note app. Not an agent framework.
Run two destinations on one substrate. Governed authorship and team-scope trust start now; exact evidence and life-scale ingest advance beside them. Full multi-writer coalescence waits for correction lineage, but the personal archive never waits for coalescence.
This vision was checked against the running architecture and current main branch, not merely the prose. The result is encouraging and a little spicy: Sibyl has quietly outrun parts of its own roadmap.
A source import currently accumulates raw IDs, source IDs, dedupe keys, skipped records, and source-to-memory mappings on one parent. At hundreds of thousands of items, resume repeatedly reconstructs and serializes a giant mutable object.
MBOX batches reopen and materialize keys; Maildir batches rebuild and sort the listing. Resume is ordinal-based rather than byte-indexed, turning a large archive into repeated whole-corpus work.
A sovereign archive must preserve exact RFC/MBOX bytes, MIME structure, labels, headers, and attachment hashes. Parsed text is a useful projection. It is not raw evidence.
An internal audit of 1,732 local agent transcripts found ritual-heavy read verbs, seven importance keys, four project-scope expressions, narrow use of a 33-kind ontology, and correction machinery separated from ordinary capture. Unify the authoring and recall surfaces, collapse duplicate fields and scope resolution, and advertise a smaller coherent vocabulary without deleting the richer backend model. Transcript counts are host-conditioned evidence, not a referendum on capability.
Audited against the repository overview, Northstar, the post-1.0 roadmap, source adapters, import state, retrieval services, usage services, web surfaces, tests, and git history at 8df846ea. The linked SIBYL_1_1_IMPLEMENTATION_PLAN.md does not exist in this tree.
The frontier is fragmenting into coding provenance, agent memory, temporal graphs, local capture, portable data, and platform-managed context. Sibyl’s opportunity is to compose those truths into one governed life substrate without pretending one index solves every problem.
Git-linked checkpoints preserve prompts, transcripts, tool calls, file changes, tokens, and attribution. They support review and search; resume and rewind are available where the agent integration supports them.
Steal the atom: generalized evidence-bound checkpoints. Ingest Entire; do not turn Git into the universal store for human life.
Memory blocks, archival tiers, file search, extraction, consolidation, and agent state are becoming standard primitives. Mem0 v3’s ADD-only extraction and hybrid semantic, BM25, and entity retrieval is a concrete signal for selective graph use instead of a mandatory external graph store.
Sibyl’s edge: one evidence model across agents, sources, people, tasks, permissions, and time.
Temporal property graphs and conflict-aware retrieval make changing facts and multi-hop association first-class. They validate the graph, but not graphing everything.
Upgrade the truth model: bitemporal assertions, alternatives, attribution, confidence, and reversible identity clusters.
Local screen/audio capture, self-hosted second brains, and user-controlled data pods point toward ambient, portable, human-owned context.
Integrate the sensors: Sibyl should be their evidence and policy layer, not rebuild every capture application.
World facts, experiences, observations, and confidence-bearing opinions are separated, then recalled through semantic, keyword, graph, and temporal paths.
Closest overlap: Sibyl must differentiate through source-complete life ingest, authorization, derivation lineage, checkpoints, and verifiable forgetting.
Multimodal memory roles and productized connectors prove the appetite for memory beyond chat. Their breadth raises the bar for Sibyl’s ingestion experience.
Sibyl’s answer: exact evidence, governed derivation, portable ownership, and one trust model across every modality.
Controlled experiments on LongMemEval and HaluMem show that representation choices, update semantics, filtering, retrieval depth, and model settings can dominate the graph-versus-flat label. Group and social memory remain brutally unsolved.
LongMemEval V2 includes histories of up to 500 trajectories and 115 million tokens, testing workflows, gotchas, changing state, and premise awareness. Its authors report AgentRunbook-C, which stores trajectories as files and invokes a coding agent to gather evidence, at 72.5% versus 48.5% for the strongest RAG baseline. This supports durable experience retrieval; it does not yet prove distilled procedures outperform raw trajectories.
Deployment-Time Memorization reports that raw-only deletion left derived summary copies recoverable in about 20% of tested cases. GateMem found that no evaluated method simultaneously achieved strong utility, robust access control, and reliable forgetting. Provenance remains an additional Sibyl requirement.
Primary references: Entire checkpoints, Entire security, Letta memory, Graphiti, Hindsight, MIRIX, HippoRAG 2, LongMemEval V2, Does Memory Need Graphs?, GroupMemBench, GateMem, and Deployment-Time Memorization.
Keep SurrealDB as the governed brain for identity, time, policy, tasks, lineage, and hot retrieval. Add an encrypted content-addressed vault for exact bytes and large media. That is not a second mutable product database. It is the durable evidence plane from which every projection can be rebuilt.
Exact, immutable, encrypted evidence with portable fixity.
A resumable source ledger that accounts for every occurrence and transform.
People, events, artifacts, assertions, conflicts, and change across time.
Rebuildable episodic, semantic, procedural, and preference projections.
An authorization-first compiler that builds cited context for one purpose.
Stable identities, governed memory authorship, checkpoints, and action receipts.
The Life Browser, trust center, import fidelity, costs, and system health.
Original files, exact messages, attachments, photos, recordings, documents, and exports live as hash-addressed encrypted objects. Their inventory, fixity, source occurrence, policy, and deletion state live in the brain. A user can verify, export, restore, or rebuild without trusting a proprietary graph forever.
SurrealDB remains the coherent runtime for graph relations, content metadata, bitemporal truth, policy, tasks, context packs, usage events, and hot indexes. High-rate telemetry stays columnar until it earns promotion into meaningful events.
| Universal primitive | What it means | Invariant |
|---|---|---|
| Blob | Exact immutable bytes, media type, hash, encryption metadata | Never confused with extracted or generated text |
| SourceOccurrence | Where, when, and under which native identity evidence appeared | Repeated exports and duplicate appearances remain auditable |
| Observation | A directly parsed or measured property of evidence | Deterministic extraction remains distinct from inference |
| Assertion | A claim with valid time, system time, authority, confidence, and evidence | Contradictions coexist until resolved; history is never rewritten |
| TransformRun | Code, model, prompt digest, inputs, outputs, cost, and failure receipt | Every projection is reproducible or explicitly non-reproducible |
| ContextPack | An immutable manifest of policy-filtered references and projections an agent received | Hash-addressed and cited; referenced personal payload remains revocable |
| MemoryOp | An idempotent, revision-aware request to assert, annotate, contest, supersede, report, nominate, or forget | Every mutation carries actor, purpose, basis, evidence, policy, and expected revision |
| MutationReceipt | The applied revision, affected projections, policy decision, and compensation path | No silent write; retry is safe; destructive and scope-crossing operations can be previewed |
| SessionCheckpoint | A branchable record of context, transcript span, tool receipts, commitments, and working state | Forks preserve ancestry; merges never promote hypothetical state into observed truth |
| DeletionReceipt | A non-sensitive proof that lineage was purged or invalidated | Access revokes immediately; managed derivatives purge and backups expire by policy |
Standards to borrow rather than reinvent: W3C PROV-O for provenance, Web Annotation selectors for evidence regions, Media Fragments for audio and video, OCFL for archival fixity, and bitemporal modeling for “what was true” versus “when Sibyl learned it.”
Sibyl already has a richer internal graph than agents can safely write. The next practical leap is not eighteen new knobs or autonomous self-editing. It is one coherent authorship contract: agents can contribute structured judgment, challenge bad memory, and report what happened; policy and evidence decide what becomes durable.
Architecture map, not a benchmark. Products span cells and continue to evolve; the important distinction is whether structured memory is only pipeline output or also a governed medium an agent can deliberately improve.
Assert, annotate, relate, contest, supersede derived claims, report outcomes, propose retention or sharing, request forgetting, and checkpoint a branch. Each act names its basis, evidence, purpose, actor, scope, and expected revision.
Rewrite source evidence, mint verification, grant themselves access, erase another person’s history, let a time-to-live delete evidence, or silently promote an inference or hypothetical branch into observed truth.
Basis, confidence, evidence, valid interval, referents, fidelity, and scope travel with the claim. Observed, reported, inferred, and hypothetical never collapse into one generic “memory.”
Support, contradict, supersede, justify, bind, exemplify, and depend-on become typed relations with actor, evidence, time, confidence, and policy, not unqualified edges.
Mark stale, misleading, duplicate, unresolved, or contradicted state. Semantic correction preserves revision history; sovereign deletion still removes managed evidence and descendants.
Agents can nominate retention, broader scope, consolidation, verification, future hooks, and tripwires. Policy and humans accept, narrow, defer, or reject the proposal.
Useful, cited, ignored, misleading, corrected, and outcome-bearing signals attach to the exact assertion, ContextPack, task, purpose, agent, model, and reason. A bad result in one context is not a global death sentence.
Session checkpoints bind parentage, context hash, transcript span, tool receipts, commitments, omissions, grants, and working state. Forks can merge learning without flattening their histories.
action: contest
target: assertion:7f3
expected_revision: 12
basis: execution_outcome
context_pack: sha256:91c…
identity ✓
revision ✓
evidence ✓
scope: project only
policy: allow with lineage
applied: true
revision: 13
projection_jobs: 4
reversible: true
compensation: op:8a1
Retrieval is not the end of the loop. Every use, correction, contradiction, result, and deletion should refine what the next agent receives while preserving the evidence needed to explain why.
Exposure, citation, outcome, correction, and recurrence determine promotion, dormancy, review, or retirement without destroying evidence.
Basis and confidence meet real results; calibration curves then influence trust-weighted retrieval for comparable future work.
A code symbol, person, policy, or project changes; contradiction and validity checks supersede stale projections before context recompiles.
Repeated episodes propose procedures and principles. Evidence, failures, and human corrections stay attached to the distilled result.
A source correction, policy change, model upgrade, or deletion invalidates descendants and rebuilds only the affected worldview.
Checkpoint, outcome, and correction produce reusable procedure, known failure modes, and a smaller, sharper next ContextPack.
The target contract synthesizes current Sibyl code, the independently authored “Hand the Agent the Pen” review, Anthropic’s client-side memory tool, Letta memory blocks, A-MEM, Memory-R1, and Mem-alpha. Names and envelopes shown here are proposed architecture, not current CLI or MCP syntax.
These are product constraints, not branding. If a feature violates one, the feature is wrong or its trust boundary is dishonest.
Preserve evidence exactly until the owner deletes it. User intent outranks append-only aesthetics, and erasure must invalidate every descendant projection.
A claim without evidence, transformation lineage, authority, and temporal state is a suggestion, never truth. Answers expose the boundary between source, inference, and uncertainty.
Derived artifacts use deny-overrides across every source policy and retain the most restrictive purpose, audience, retention, locality, and sensitivity bounds. Transformation cannot launder private data into a shareable artifact.
Import authority does not grant unrestricted sharing or inference rights over correspondents, bystanders, minors, or household members. Subject identity, sensitive-category policy, disclosure boundaries, and legally required suppression or deletion travel through every derived artifact and export.
Agents receive short-lived, purpose-bound capabilities for specific tools, spaces, data classes, providers, and egress. Every action records the context pack that informed it.
Agents may contribute, challenge, supersede derived claims, report outcomes, and propose policy. They cannot rewrite evidence, mint verification, self-grant access, erase another person’s history, or silently convert hypothesis to truth.
Email, webpages, documents, transcripts, and chat remain permanently typed as untrusted. A hostile message cannot silently acquire the execution authority of the agent reading it.
Deterministic metadata and search land first. Expensive enrichment is selective, asynchronous, cached by transform digest, and focused on hot, cited, or queried evidence.
Indexes, chunks, embeddings, entities, summaries, beliefs, and context packs are materialized views. Model upgrades become controlled recompilation, not data loss or migration panic.
Gmail Takeout should become Sibyl’s corpus-defining trial: millions of messy MIME messages, attachments, labels, aliases, duplicates, malformed records, and decades of changing relationships. Search must work early. Restarts must be exact. Every generated claim must lead back to the message bytes that earned it.
Archive hash, byte ranges, exact source slices, manifests, cursors, quarantine.
MIME, headers, participants, labels, references, attachments, lexical search.
Embeddings, language, OCR, attachment text, entity candidates, visual indexes.
Events, commitments, relationship hypotheses, procedures, cited summaries.
Concept interface and target corpus, not a screenshot of the current importer.
Scan each MBOX once and record message byte ranges. Workers consume independent ranges without rebuilding a mailbox table of contents. Every byte belongs to an exact message slice or a visible quarantine segment.
Track exact byte identity, logical message identity, and source occurrence separately. Identical bytes share storage; likely equivalents form reversible clusters; repeated exports and label changes remain provenance.
Replace the ever-growing parent import row with a compact run plus append-only chunk and record receipts. Checkpoint the archive hash, member, byte offset, ordinal, and parser version only after evidence and occurrences commit.
On an 8-core, 32 GiB, NVMe reference machine: sustain at least 100 MB/s for the boundary scan and 25 MB/s for durable Tier 0 import. Recover in under 60 seconds, reprocess at most 128 MiB, and make Tier 1 search available continuously.
After the historical archive lands, use Gmail history for incremental change. Cursor expiry is normal: a 404 triggers full reconciliation without duplicating evidence or forgetting deletions.
Source contracts: Gmail export contents, Google Takeout, RFC 4155 MBOX, RFC 5322 messages, and Gmail incremental sync. Google exports labels in X-Gmail-Labels; MBOX variations must be treated as hostile reality, not parser edge cases.
The target connector contract requires every adapter to converge on the same durable state machine: inventory → snapshot → resume → stream → reconcile → tombstone → verify. Native data stays intact; shared envelopes make cross-source reasoning possible.
Takeout, MBOX, Maildir, IMAP/JMAP, Gmail, Slack, Discord, Messages, Signal exports, vCard.
Drive, local files, Git, CI, Claude/Codex sessions, Entire checkpoints, notes, bookmarks.
iCalendar, browser history, My Activity, maps exports, trips, reservations, browsing capture.
Originals plus sidecars, EXIF/XMP, OCR, page layout, transcripts, speakers, scenes, timecodes.
FHIR, Apple Health exports, workouts, sleep, labs, symptoms, medications, devices, provenance.
OFX/QFX/CSV, invoices, receipts, subscriptions, warranties, tax documents, asset history.
Home Assistant, energy, network, sensors, media, vehicle, weather, maintenance, state changes.
Provider archives first, continuous APIs second, open interchange always, federated mode optional.
Inventory, exact-match, metadata, and lexical search arrive without an AI provider. Local embeddings and deterministic extraction follow. Model cognition is reserved for evidence users actually query, cite, revisit, or ask Sibyl to synthesize.
High-rate sensor, browser, and media observations remain in append-friendly raw or columnar storage. Meaningful episodes, anomalies, commitments, relationships, and long-lived assertions are promoted into the graph with evidence selectors.
Portability references: Data Transfer Project, Solid, Google Data Portability API, JMAP Mail, iCalendar, and FHIR.
Continuous full-library Google Photos sync cannot rely on the Library API: full-library read scopes were removed after 31 March 2025. The Picker API exposes user-selected media, while Library API reads are limited to app-created content. Historical full-library acquisition therefore remains archive-first. Official API update.
Retrieval returns candidates. A context compiler produces a governed artifact for a particular agent, purpose, moment, and budget. It knows which sources failed, which claims conflict, what was excluded by policy, and whether the remaining evidence is strong enough to act on.
Successful and failed trajectories become procedures with preconditions, decisions, tool receipts, failure signatures, outcomes, and source code or artifact evidence. Agents inherit lessons, not bloated transcripts.
Extend Entire’s commit-linked atom to sent email, calendar changes, purchases, deployments, document edits, home actions, and task completion. Capture intent, inputs, before and after state, effect, attribution, and an explicit compensation path. Claim rewind only when the underlying provider supports reversal.
Surface belief authority, confidence, contradictions, freshness, supporting and opposing evidence, model transforms, and who corrected what. Trust becomes an interface, not a tiny citation icon.
Background jobs propose new procedures, identity links, summaries, stale beliefs, and unresolved commitments. High-impact changes enter a correction inbox with a diff and evidence. Low-risk projections remain reversible and fully rebuildable.
Extend Sibyl’s Open Knowledge Format support into a portable, signed agent-context bundle: evidence references, assertions, procedures, permissions, citations, checkpoints, and usage receipts with clear redaction semantics.
Entire demonstrates the value of capturing agent sessions and binding checkpoints to artifacts. LongMemEval V2’s strongest reported approach lets an agent search trajectories as files; the lesson is durable workflow memory, not loyalty to one index.
Google’s 2026 Personal Intelligence paper independently frames life-scale reasoning as a context-packing problem: email and photos alone exceed a million-token window by orders of magnitude, requiring tool use, dense retrieval, and dynamic context assembly.
At full power, Sibyl becomes a humane observatory for a life. The wedge is narrower and already alive: agents that cheaply recall, author, challenge, correct, and cite memory while work is happening. The Life Browser earns itself from those receipts, beginning with the trust center, corrections, source fidelity, and time machine. Ask is one doorway; browse, correct, compare, and grant are equally important verbs.
The idea appears first as scattered notes, then becomes a concrete repository after an agent-session experiment. The major directional shift arrives when source provenance and shared task state replace “better semantic search” as the center of gravity. Confidence is high; two dates remain approximate because one source has no original timestamp.
7 citations · 2 counter-signals · 1 date uncertainQuery world time and knowledge time separately. Reconstruct decisions without present-day contamination.
Detect commitments, deadlines, dependencies, unresolved threads, and the evidence that created them.
Weekly deltas across people, projects, health, home, money, beliefs, and agent-learned procedures.
Every suggestion states its trigger, evidence, permission, expected value, and one-click dismissal or mute.
A server cannot simultaneously know nothing, perform arbitrary semantic search, and think across a life for remote agents. Sibyl should expose explicit trust lanes and make the operational consequences impossible to miss.
The owner-controlled server decrypts and processes. Encryption protects rest and transit, not a compromised host. This is Sibyl’s credible near-term default.
Models and indexes run on trusted devices. Sync and backups carry ciphertext. External egress is opt-in per task, source, or space.
Keys release only to attested environments. Useful protection in use, with explicit hardware and side-channel trust.
The server cannot read plaintext; trusted clients search and reason. Without ORAM or equivalent protection, metadata, timing, size, and access patterns may still leak. Embeddings remain sensitive derivatives.
Short-lived tokens bind the human, acting agent, purpose, audience, task, spaces, source classes, sensitivity ceiling, allowed providers, egress, tools, and read/write/share/export capabilities. Memory scope and action scope remain separate.
Freeze access, remove or crypto-shred raw objects, traverse descendants, purge chunks, embeddings, assertions, summaries, packs, caches, managed exports, and training queues, recompute shared artifacts, then verify absence through normal retrieval. Copies exported beyond Sibyl require their own retention contract.
Security grounding: OAuth Rich Authorization Requests, OAuth Token Exchange, OWASP prompt injection, embedding inversion research, Opal’s access-pattern-private memory, and GDPR Article 17.
The system becomes next-level when it stops behaving like a smarter search box and starts preserving the causal, relational, procedural, and moral texture of a life. The magic should first appear in an ordinary day, not a speculative demo.
Reconstruct evidence, relationships, assumptions, and knowledge available at a past moment without contaminating it with hindsight.
Export an encrypted, self-describing vault with recovery keys, provenance, relationships, procedures, and chosen legacy instructions.
Teams negotiate common assertions and procedures while private evidence stays private and disagreement remains attributable.
Run two interlocking rails. Active v1.1 proof commitments stay intact while the governed pen begins now and deepens every release. The Vault makes source truth exact; Gmail proves fidelity and scale; the Life Browser grows from correction and trust receipts. Team-scope trust continues throughout, while full cross-writer coalescence waits for correction lineage and personal reconciliation to prove themselves.
Freeze scope and prove what main already claims. Ship the receipts before adding another memory abstraction.
Make whole-life ingestion trustworthy and boring: exact evidence, bounded state, resumable transforms, real objects, and a humane import cockpit.
Turn evidence into a bitemporal worldview, learned procedures, exact context packs, and the first complete Life Browser.
Generalize proven personal reconciliation to multiple writers and teams. Shared memory becomes a negotiated projection with reversible lineage.
Become the continuous local-first substrate beneath trusted agents, multimodal archives, home systems, and a human’s chosen devices.
| Release | Governed authorship rail | What becomes newly trustworthy |
|---|---|---|
| v1.1 · Receipt floor | Idempotent MemoryOps, expected revisions, MutationReceipts, contextual outcomes, and one obvious capture path | Agents can challenge and report without silent mutation or vocabulary explosion |
| v1.2 · Safe substrate | Stable identities, orthogonal lifecycle states, revision journal, exact evidence, and correction/deletion propagation | A mutation can be retried, audited, compensated, recompiled, or erased correctly |
| v1.3 · Expressive assertions | Basis, confidence, premise links, known unknowns, referent validity, hooks, tripwires, blame, and SessionCheckpoints | Agents express why memory should be believed, revisited, or distrusted |
| v1.4 · Multiple writers | Disputes, governed scope proposals, contribution boundaries, and cross-writer calibration | People and agents coalesce memory without false consensus or private-evidence leakage |
| v2.0 · Learned refinement | Predictive routing, outcome-trained reranking, reconsolidation, and ontology analytics behind explicit gates | The system gets better from experience without handing a model unilateral control |
A life system needs product, retrieval, privacy, scale, and recovery gates in the same release packet. Answer quality without fidelity is corruption; speed without authorization is leakage; deletion without lineage is theater.
| Dimension | Release gate | Failure that blocks shipping |
|---|---|---|
| Corpus fidelity | 100% bytes inventoried as evidence or quarantine; no silent skips | Any unaccounted source region or destructive logical dedupe |
| Idempotency | Random-kill replay ends at the same manifest root with 0 loss / 0 dup | Archive-size-dependent restart or mutable giant import state |
| Retrieval | Known-item Recall@10 ≥ 98%; answer and retrieval accuracy reported separately | Improved aggregate score hiding unsupported generated claims |
| Temporal truth | Updates, contradictions, premise failures, and “known then” all pass | Latest-value overwrite erases a valid historical belief |
| Authorization | Zero cross-space and cross-org leaks under adversarial queries and caches | Post-filtered retrieval or derived artifacts with weaker policy |
| Forgetting | Zero recoverable residue across Sibyl-managed raw data, graph, indexes, summaries, packs, caches, and exports after the policy deadline | Deleted facts remain retrievable through Sibyl after the declared deadline; unmanaged exports receive revocation records but remain outside enforcement |
| Scale | 1M and 10M item suites; 100+ hot orgs; import/search/decay concurrently | Fixed global caps, dropped work, hidden queue lag, or serial query paths |
| Rebuild | Derived indexes and graph projections rebuild from Vault evidence plus signed Chronicle and control-plane backups | Restore drill misses keys, auth, policy, corrections, tasks, usage, or user-authored state |
| Life-context integrity | Tunnel vision, preference and relationship attribution, timeline mixing, changed circumstances, and confirmation-versus-completion cases all pass | A plausible answer that confuses whose preference, which time, or whether an intended action actually happened |
| Agent utility | Outcome lift, citation, mislead, correction, abstention, and procedure reuse measured against exact ContextPacks | More recalled tokens or global popularity presented as proof of better decisions |
| Human trust | Corrections propagate, suggestions explain “why now,” every source can be muted | Creepy proactivity, invisible inference, or no meaningful user recourse |
The ultimate system stays coherent by integrating excellent sensors and harnesses, using the graph selectively, and keeping the evidence plane sovereign.
Ingest Entire, screenpipe, provider archives, Data Transfer Project adapters, and open formats. Own the evidence contract.
Land deterministic search immediately; enrich progressively where use, curiosity, or explicit policy earns the cost.
Graph durable identity, assertions, events, causality, policy, and lineage. Keep chunks and telemetry in their natural indexes.
Be the cross-harness context, checkpoint, permission, and learning layer. Let specialized runtimes execute.
Capture must be intentional, inspectable, source-scoped, pausable, locally filterable, and independently deletable.
State which machine decrypts, searches, embeds, and thinks. Treat vectors, caches, prompts, and traces as sensitive derivatives.
Partition durable work, expand pools, batch materialization, and drain faster than arrival. Backpressure may delay; it never drops truth.
Content hashes, signed manifests, Merkle receipts, and append-only lineage provide verifiability without a speculative consensus machine.
Primary documentation, standards, papers, and repository evidence reviewed for this vision. Product claims are separated from proposed architecture and target gates throughout the document.
Research cutoff: 9 July 2026. Repository claims were verified against local source and history; external claims were grounded in primary documentation, specifications, or papers. Throughput and quality numbers labeled as gates are proposed acceptance targets, not measured current performance. Cross-model synthesis froze “Hand the Agent the Pen” at SHA-256 06a5355406ffe49ffbe5401789d3ffaf4aa27bbf62a185e64fcca188cc319aec; its dual-track re-verdict is reflected in the release spine.